~ / search / GHSA-33fm-6gp7-4p47

GHSA-33fm-6gp7-4p47

Weblate has an argument injection in management console

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-24126

Packages

EcosystemPackageAffectedFixed in
PyPI Weblate < 5.16.0 5.16.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. ### Patches * https://github.com/WeblateOrg/weblate/pull/17722 ### Workarounds Properly limit access to the management console. ### References This issue was reported to us by [alexb_616](https://hackerone.com/alexb_616) via HackerOne.

References

External links from the advisory. They lead to third-party sites.